CVE-2018-19791
Summary
| CVE | CVE-2018-19791 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-12-03 06:29:00 UTC |
| Updated | 2019-02-05 16:10:00 UTC |
| Description | The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the "bytes=0-,0-" substring. |
Risk And Classification
Problem Types: CWE-20
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Litespeedtech | Openlitespeed | All | All | All | All |
| Application | Litespeedtech | Openlitespeed | 1.5.0 | - | All | All |
| Application | Litespeedtech | Openlitespeed | 1.5.0 | rc1 | All | All |
| Application | Litespeedtech | Openlitespeed | 1.5.0 | rc2 | All | All |
| Application | Litespeedtech | Openlitespeed | 1.5.0 | rc3 | All | All |
| Application | Litespeedtech | Openlitespeed | 1.5.0 | rc4 | All | All |
| Application | Litespeedtech | Openlitespeed | 1.5.0 | rc5 | All | All |
| Application | Litespeedtech | Openlitespeed | All | All | All | All |
| Application | Litespeedtech | Openlitespeed | 1.5.0 | - | All | All |
| Application | Litespeedtech | Openlitespeed | 1.5.0 | rc1 | All | All |
| Application | Litespeedtech | Openlitespeed | 1.5.0 | rc2 | All | All |
| Application | Litespeedtech | Openlitespeed | 1.5.0 | rc3 | All | All |
| Application | Litespeedtech | Openlitespeed | 1.5.0 | rc4 | All | All |
| Application | Litespeedtech | Openlitespeed | 1.5.0 | rc5 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Vulnerabilities in Openlitespeed web server · Issue #117 · litespeedtech/openlitespeed · GitHub | MISC | github.com | Exploit, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.